@cohortapp/agent-sdk 2.3.0

package/scripts/daemon/agent-daemon.test.mjs

@@ -0,0 +1,525 @@
+/**
+ * agent-daemon.test.mjs — F1/H2 message-loss window (task #16, 0.8 follow-up).
+ *
+ * Before this fix, processItem() called markProcessed() (rename → .processed)
+ * IMMEDIATELY after a fire-and-forget dispatch(). A crash before the spawned
+ * session closed left the user's inbox item `.processed` with redelivery
+ * blocked — the message was silently lost.
+ *
+ * The fix defers the finalize to the dispatch onClose SUCCESS path and records a
+ * durable in-flight admission so a restart re-delivers an un-finalized item:
+ *   • clean close  → markProcessed() + clearInFlight()  (finalize)
+ *   • non-zero / spawn error → clearInFlight() + releaseLock() (re-deliverable)
+ *   • crash mid-flight → admission survives; recoverInFlight() (startup) releases
+ *     the per-item lock so the still-un-`.processed` file is re-polled.
+ *
+ * These tests drive the REAL daemon helpers (recordInFlight / clearInFlight /
+ * markProcessed / recoverInFlight) and the REAL per-item lock from
+ * session-lock.mjs, asserting the on-disk state that the poller would observe.
+ *
+ * The daemon module statically pulls in the agent-only `imapflow` dep (via the
+ * gmail poller) which isn't packaged in CI, so we register a tiny in-process
+ * ESM loader that stubs `imapflow` to a no-op class. Everything else in the
+ * daemon's import graph resolves normally, so the code under test is the real
+ * implementation, not a re-creation.
+ */
+
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import { register } from "node:module";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+// --- stub the agent-only `imapflow` dep so the daemon module can be imported ---
+const loaderSrc = `
+export async function resolve(specifier, context, next) {
+  if (specifier === "imapflow") return { url: "imapflow-stub:main", shortCircuit: true };
+  return next(specifier, context);
+}
+export async function load(url, context, next) {
+  if (url === "imapflow-stub:main") return { format: "module", shortCircuit: true, source: "export class ImapFlow {}" };
+  return next(url, context);
+}
+`;
+register(`data:text/javascript,${encodeURIComponent(loaderSrc)}`);
+
+// One shared AGENT_DIR for the whole file: session-lock.mjs (imported transitively
+// by the daemon) reads AGENT_DIR at module-eval time and is cached by URL, so all
+// imports must agree on the dir. Per-test isolation comes from unique item ids and
+// a clean-between-tests of the relevant state subdirs.
+const AGENT_DIR = mkdtempSync(join(tmpdir(), "maestro-agent-daemon-"));
+process.env.AGENT_DIR = AGENT_DIR;
+process.env.MAESTRO_DAEMON_NO_AUTOSTART = "1"; // import without spinning the poll loops
+
+let daemon;       // the real daemon module (recordInFlight/clearInFlight/markProcessed/recoverInFlight)
+let lock;         // the real session-lock module (acquireLock/readLock)
+let bus;          // the real hook-bus module (getHookBus/resetHookBus) — shared singleton
+let counters;     // the real counters module (snapshot/resetMem) — shared transitive import
+
+before(async () => {
+  mkdirSync(join(AGENT_DIR, "state", "inbox", "slack"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "sessions", "locks"), { recursive: true });
+  const dURL = new URL("./agent-daemon.mjs", import.meta.url);
+  daemon = await import(`${dURL.href}?f1h2=${Math.random()}`);
+  lock = await import("./session-lock.mjs");
+  // These are the SAME singletons the daemon reaches transitively (imported by
+  // bare specifier, so the module cache shares them) — that's what lets the test
+  // emit on the same bus the daemon subscribed to and read the same counters.
+  bus = await import("../../lib/hooks/bus.mjs");
+  counters = await import("../../lib/diagnostics/counters.mjs");
+});
+
+// Read the diagnostic-event rows the daemon appended to its tmp
+// logs/diagnostics/<UTC-date>.jsonl stream. [] when none written.
+function readDiagnostics() {
+  const date = new Date().toISOString().slice(0, 10);
+  const path = join(AGENT_DIR, "logs", "diagnostics", `${date}.jsonl`);
+  let raw = "";
+  try { raw = readFileSync(path, "utf-8"); } catch { return []; }
+  return raw.split("\n").filter(Boolean).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+}
+
+function slackInbox() { return join(AGENT_DIR, "state", "inbox", "slack"); }
+function inflightDir() { return join(AGENT_DIR, "state", "inbox-inflight"); }
+
+function resetState() {
+  for (const d of [slackInbox(), inflightDir(), join(AGENT_DIR, "state", "sessions", "locks")]) {
+    try { for (const f of readdirSync(d)) rmSync(join(d, f), { force: true }); } catch { /* */ }
+  }
+}
+
+/**
+ * Write a live (un-.processed) poller-style inbox file for an item, returning
+ * the filename. Mirrors the real poller naming (`<ts>-<item.id>.yaml`) so that
+ * markProcessed's id/raw_ref substring match finds it, exactly as in production.
+ */
+function writeLiveItem(item) {
+  const name = `2026-06-10T00-00-00Z-${item.id}.yaml`;
+  const body = [
+    `id: "${item.id}"`,
+    `service: "slack"`,
+    `channel_id: "${item.channel || "D1"}"`,
+    `timestamp: "2026-06-10T00:00:00Z"`,
+    `content: |`,
+    `  hello`,
+    "",
+  ].join("\n");
+  writeFileSync(join(slackInbox(), name), body);
+  return name;
+}
+
+function inboxFiles() { return readdirSync(slackInbox()).sort(); }
+function inflightFiles() { try { return readdirSync(inflightDir()).filter((f) => f.endsWith(".json")); } catch { return []; } }
+
+// ---------------------------------------------------------------------------
+// 1) Crash between dispatch and close → item is RE-DELIVERABLE (not .processed),
+//    and recoverInFlight() releases the gating lock so the next poll re-delivers.
+// ---------------------------------------------------------------------------
+
+test("F1/H2: a crash between dispatch and close leaves the item re-deliverable (not .processed)", () => {
+  resetState();
+  const item = { id: "MSG-CRASH", raw_ref: "slack:C1:1001", channel: "D1", sender: "ceo" };
+  const name = writeLiveItem(item);
+
+  // Simulate processItem up to (but not past) the dispatch: the poll filter holds
+  // the per-item lock, and the daemon records the durable in-flight admission.
+  const acq = lock.acquireLock(item.raw_ref, { sender: item.sender, channel: item.channel });
+  assert.equal(acq.acquired, true, "poll filter acquired the per-item lock");
+  daemon.recordInFlight(item, "slack");
+
+  // --- CRASH HERE: no onClose ran, so markProcessed was never called. ---
+  // The user's message must NOT be .processed (the whole bug).
+  assert.deepEqual(inboxFiles(), [name], "file is still live (un-.processed) after a mid-flight crash");
+  assert.equal(inflightFiles().length, 1, "the in-flight admission survives the crash");
+  // The held lock would block a naive re-poll until the 2h stale TTL — that is
+  // exactly what recovery must clear.
+  assert.equal(lock.acquireLock(item.raw_ref).acquired, false, "lock still held → re-poll blocked pre-recovery");
+
+  // --- RESTART: recoverInFlight() releases the lock so the next poll re-delivers. ---
+  const n = daemon.recoverInFlight();
+  assert.equal(n, 1, "one in-flight admission recovered");
+  assert.equal(inflightFiles().length, 0, "admission cleared after recovery");
+  assert.deepEqual(inboxFiles(), [name], "the message is STILL on disk, un-.processed → re-deliverable");
+  assert.equal(lock.acquireLock(item.raw_ref).acquired, true, "the gating lock was released → next poll re-delivers");
+});
+
+// ---------------------------------------------------------------------------
+// 2) A clean close finalizes the item (markProcessed) and clears the admission.
+// ---------------------------------------------------------------------------
+
+test("F1/H2: a clean close finalizes the item (markProcessed) and clears the in-flight admission", () => {
+  resetState();
+  const item = { id: "MSG-OK", raw_ref: "slack:C2:2002", channel: "D2", sender: "ceo" };
+  const name = writeLiveItem(item);
+  lock.acquireLock(item.raw_ref, { sender: item.sender });
+  daemon.recordInFlight(item, "slack");
+  assert.equal(inflightFiles().length, 1);
+
+  // onClose({ok:true}) success path (the exact wiring processItem installs).
+  daemon.markProcessed(item, "slack");
+  daemon.clearInFlight(item);
+
+  assert.deepEqual(inboxFiles(), [`${name}.processed`], "clean close finalized the item to .processed");
+  assert.equal(inflightFiles().length, 0, "admission cleared on finalize");
+  // A clean close finalized work that already completed — recovery is a no-op,
+  // and there is no live file left for the poller to re-deliver.
+  assert.equal(daemon.recoverInFlight(), 0, "nothing to recover after a clean finalize");
+});
+
+// ---------------------------------------------------------------------------
+// 3) A non-zero close / spawn error leaves the item re-deliverable and releases
+//    the lock immediately (no need to wait for restart).
+// ---------------------------------------------------------------------------
+
+test("F1/H2: a failed close leaves the item re-deliverable and releases the lock now", () => {
+  resetState();
+  const item = { id: "MSG-FAIL", raw_ref: "slack:C3:3003", channel: "D3", sender: "ceo" };
+  const name = writeLiveItem(item);
+  lock.acquireLock(item.raw_ref, { sender: item.sender });
+  daemon.recordInFlight(item, "slack");
+
+  // onClose({ok:false}) failure path: clear admission + release lock, but DO NOT
+  // markProcessed — the message stays re-deliverable.
+  daemon.clearInFlight(item);
+  lock.releaseLock(item.raw_ref);
+
+  assert.deepEqual(inboxFiles(), [name], "failed session left the item live (un-.processed)");
+  assert.equal(inflightFiles().length, 0, "admission cleared on failure");
+  assert.equal(lock.acquireLock(item.raw_ref).acquired, true, "lock released → next poll re-delivers immediately");
+});
+
+// ---------------------------------------------------------------------------
+// 4) recoverInFlight() is a clean no-op when nothing is pending, and never
+//    touches already-.processed files.
+// ---------------------------------------------------------------------------
+
+test("F1/H2: recoverInFlight is a no-op with no pending admissions", () => {
+  resetState();
+  assert.equal(daemon.recoverInFlight(), 0, "no admissions → recovered 0");
+});
+
+test("F1/H2: recordInFlight is a no-op for an item with no lock key (e.g. backlog)", () => {
+  resetState();
+  daemon.recordInFlight({ title: "deep work" }, "backlog");
+  assert.equal(inflightFiles().length, 0, "no raw_ref/id → no admission written (backlog items are durable in queue files)");
+});
+
+// ===========================================================================
+// DIAG — the observability spine wired into the LIVE inbound pipeline.
+// ===========================================================================
+//
+// processItem() mints ONE trace_id per item and emits item_received → … → sent
+// (on a clean finalize) all under it. The daemon also registers the ONE real
+// hook-bus subscriber (onGuardFail → counters.bump("guard.fail")) so the bus is
+// live. STRICT additive: emitEvent + counters.bump never throw, and the dispatch
+// /classify/send semantics are untouched (the heavy collaborators are injected
+// here ONLY so the test drives the real instrumented body without spawning a
+// `claude` child — production passes no deps).
+
+function clearDiagnostics() {
+  for (const sub of ["diagnostics", join("diagnostics", "counters")]) {
+    const d = join(AGENT_DIR, "logs", sub);
+    try { for (const f of readdirSync(d)) { if (f.endsWith(".jsonl")) rmSync(join(d, f), { force: true }); } } catch { /* */ }
+  }
+  try { counters.resetMem(); } catch { /* */ }
+}
+
+// ---------------------------------------------------------------------------
+// 1) A processed item emits item_received → … → sent with ONE stable trace_id.
+// ---------------------------------------------------------------------------
+
+test("DIAG: a processed item emits item_received → sent with ONE stable trace_id (the daemon's minted id)", async () => {
+  resetState();
+  clearDiagnostics();
+  // A DM (channel_id starts with "D") so it always passes the directed-message
+  // gate — keeps the test on the dispatch path deterministically.
+  const item = { id: "MSG-TRACE", raw_ref: "slack:D1:1", channel: "dm/ceo", channel_id: "D1", sender: "ceo", content: "please draft the board memo" };
+  writeLiveItem(item);
+
+  // Inject the heavy collaborators so the REAL processItem body runs (trace mint,
+  // item_received emit, dispatch onClose → sent emit) without a claude spawn:
+  //  - classify → "respond"/opus so it takes the holding+session (dispatch) path,
+  //    NOT the quick-reply path.
+  //  - isQuickReply → false to keep it on the dispatch path deterministically.
+  //  - sendHoldingMessage → no-op (no Slack post).
+  //  - dispatch → synchronously invoke onClose({ok:true}) to finalize.
+  let dispatchedItem = null;
+  await daemon.processItem(item, "slack", {
+    classify: async () => ({ priority: "critical", action: "respond", model: "opus", summary: "draft board memo", category: "action_required", directed_at_agent: true }),
+    isQuickReply: () => false,
+    sendHoldingMessage: async () => ({ sent: false, holdingText: null }),
+    dispatch: (_prompt, it, _cr, _src, opts) => { dispatchedItem = it; opts.onClose({ ok: true, code: 0 }); },
+  });
+
+  // The daemon set the minted id on the item and carried it onto the dispatch.
+  assert.ok(typeof item.trace_id === "string" && item.trace_id.length === 26, "a 26-char ULID trace_id was minted onto the item");
+  assert.equal(dispatchedItem.trace_id, item.trace_id, "the dispatch received the SAME trace_id");
+
+  const rows = readDiagnostics();
+  const received = rows.filter((r) => r.type === "item_received");
+  const sent = rows.filter((r) => r.type === "sent");
+  assert.equal(received.length, 1, "exactly one item_received");
+  assert.equal(sent.length, 1, "exactly one sent on clean finalize");
+  // The single-trace-id invariant: the first hop and the last hop share one id.
+  assert.equal(received[0].trace_id, item.trace_id, "item_received carries the minted trace_id");
+  assert.equal(sent[0].trace_id, item.trace_id, "sent carries the SAME trace_id (end-to-end correlation)");
+  // The in-flight admission also carries the trace (cheap ledger correlation).
+  assert.equal(sent[0].attrs.item_id, item.raw_ref, "sent records the item id");
+});
+
+test("DIAG: a failed (ok:false) finalize emits error (not sent), still under the one trace_id", async () => {
+  resetState();
+  clearDiagnostics();
+  const item = { id: "MSG-TRACE-FAIL", raw_ref: "slack:D2:1", channel: "dm/ceo", channel_id: "D2", sender: "ceo", content: "do the thing" };
+  writeLiveItem(item);
+
+  await daemon.processItem(item, "slack", {
+    classify: async () => ({ priority: "high", action: "respond", model: "opus", summary: "x", category: "action_required", directed_at_agent: true }),
+    isQuickReply: () => false,
+    sendHoldingMessage: async () => ({ sent: false, holdingText: null }),
+    dispatch: (_p, _it, _cr, _s, opts) => opts.onClose({ ok: false, code: 1 }),
+  });
+
+  const rows = readDiagnostics();
+  assert.equal(rows.filter((r) => r.type === "item_received").length, 1, "item_received emitted");
+  assert.equal(rows.filter((r) => r.type === "sent").length, 0, "a failed finalize must NOT emit sent");
+  const err = rows.filter((r) => r.type === "error");
+  assert.equal(err.length, 1, "a failed finalize emits an error hop");
+  assert.equal(err[0].trace_id, item.trace_id, "the error hop is under the same interaction trace_id");
+});
+
+// ---------------------------------------------------------------------------
+// 2) A send-gate block bumps the counter (responder's real instrumented path).
+// ---------------------------------------------------------------------------
+
+test("DIAG: a send-gate block bumps the send.blocked counter (responder validation path)", async () => {
+  clearDiagnostics();
+  const responder = await import("./responder.mjs");
+  // Force the generator to return text the REAL validateQuickReply blocks (AI
+  // self-disclosure) — no claude spawn, no Slack post. The block path must bump.
+  const restore = responder.setGenerateResponseForTests(async () => "Hi — I am an AI assistant, happy to help.");
+  try {
+    const before = (counters.snapshot()["send.blocked"]) || 0;
+    const res = await responder.sendQuickResponse(
+      { sender: "ceo", service: "slack", channel: "D1", content: "hello" },
+      { priority: "normal", action: "respond", model: "sonnet", summary: "hi" }
+    );
+    assert.equal(res.sent, false, "the AI-disclosure reply was blocked, not sent");
+    assert.equal(res.blocked, true);
+    const after = (counters.snapshot()["send.blocked"]) || 0;
+    assert.equal(after, before + 1, "the send-gate block bumped send.blocked by exactly one (durable JSONL)");
+  } finally { restore(); }
+});
+
+// ---------------------------------------------------------------------------
+// 3) The daemon's ONE real onGuardFail subscriber fires (the bus is live).
+// ---------------------------------------------------------------------------
+
+test("DIAG: registerHookSubscribers wires a real onGuardFail subscriber that bumps guard.fail", async () => {
+  clearDiagnostics();
+  // The daemon registers exactly one onGuardFail subscriber. It's idempotent, so
+  // calling it here (the test driver) is safe even though main() also would.
+  assert.equal(daemon.registerHookSubscribers(), true, "subscriber registered");
+  const hb = bus.getHookBus();
+  assert.ok(hb.count("onGuardFail") >= 1, "the bus has a live onGuardFail subscriber (not dead)");
+
+  const before = (counters.snapshot()["guard.fail"]) || 0;
+  // Emit a guard-fail (as the responder's send-gate fail-open path does). The
+  // real subscriber must fire and bump the durable counter.
+  const decision = await hb.emit("onGuardFail", { guard: "send_gate", reason: "policy unreadable", failed_open: true });
+  assert.equal(decision.cancelled, false, "onGuardFail is observe-only (never cancels)");
+  assert.equal(decision.errors, 0, "the subscriber did not throw");
+
+  const after = (counters.snapshot()["guard.fail"]) || 0;
+  assert.equal(after, before + 1, "the onGuardFail subscriber bumped guard.fail by exactly one");
+});
+
+test("DIAG: the responder's send-gate fail-open emits onGuardFail onto the live bus → guard.fail bumps", async () => {
+  clearDiagnostics();
+  daemon.registerHookSubscribers(); // ensure the real subscriber is live
+  const responder = await import("./responder.mjs");
+  // Generate benign text (passes validation), but force the Slack send-gate
+  // screen to throw a NON-block infra error so the responder fails OPEN and
+  // emits onGuardFail. We can't reach sendSlackMessage without a token, so we
+  // assert the wiring via the bus directly using the same emit the responder
+  // makes — the prior test proves the subscriber; here we prove a real producer
+  // shape lands on the same singleton bus the daemon subscribed to.
+  const hb = bus.getHookBus();
+  const before = (counters.snapshot()["guard.fail"]) || 0;
+  await hb.emit("onGuardFail", { guard: "send_gate", channel: "slack", recipient: "D1", reason: "gate module unreadable", failed_open: true });
+  const after = (counters.snapshot()["guard.fail"]) || 0;
+  assert.equal(after, before + 1, "a send-gate fail-open shape bumps guard.fail through the live subscriber");
+  // Tidy: drop the test reference so it doesn't leak the import.
+  void responder;
+});
+
+// ---------------------------------------------------------------------------
+// Post-session org-memory write-back (SP4) — after a clean turn, a bounded
+// distillation is authored to the shared store via remember(). Fail-open when
+// the org integration is disabled; never throws.
+// ---------------------------------------------------------------------------
+
+const ENABLED_ORG_CFG = { org: { cohort: { enabled: true, base: "https://org.example" } } };
+
+test("MEMORY: sessionDistillation produces a bounded one-line record", () => {
+  const line = daemon.sessionDistillation(
+    { sender: "Alice Smith", subject: "Q2 renewal" },
+    { action: "respond", summary: "Acme renewal terms and next steps" },
+    { agent: { firstName: "Jordan" } }
+  );
+  assert.ok(line, "should produce a distillation");
+  assert.ok(line.includes("Jordan"), "names the agent");
+  assert.ok(line.includes("respond"), "names the action");
+  assert.ok(line.includes("Alice Smith"), "names the sender");
+  assert.ok(line.includes("Acme renewal"), "carries the topic");
+  assert.ok(line.length <= 401, `bounded length, got ${line.length}`);
+});
+
+test("MEMORY: sessionDistillation returns null when there is nothing to remember", () => {
+  const line = daemon.sessionDistillation({}, {}, { agent: { firstName: "Jordan" } });
+  assert.equal(line, null, "no sender + no topic ⇒ null");
+});
+
+test("MEMORY: writeBackSession authors to the store when the org integration is enabled", async () => {
+  const calls = [];
+  const res = await daemon.writeBackSession(
+    { sender: "Alice Smith", subject: "Q2 renewal" },
+    { action: "respond", summary: "Acme renewal terms" },
+    {
+      cfg: ENABLED_ORG_CFG,
+      agent: { firstName: "Jordan" },
+      sessionId: "sess-xyz",
+      rememberImpl: async (text, opts) => { calls.push({ text, opts }); return { ok: true, mode: "append", id: "k1" }; },
+    }
+  );
+  assert.equal(res.ok, true, "write reported ok");
+  assert.equal(calls.length, 1, "remember() called exactly once");
+  assert.ok(calls[0].text.includes("Jordan"), "authored the distillation text");
+  assert.equal(calls[0].opts.cfg, ENABLED_ORG_CFG, "passed the org cfg through");
+  assert.equal(calls[0].opts.provenance.sessionId, "sess-xyz", "carried session provenance");
+});
+
+test("MEMORY: writeBackSession is a fail-open no-op when the org integration is disabled", async () => {
+  let called = false;
+  const res = await daemon.writeBackSession(
+    { sender: "Alice Smith" },
+    { action: "respond", summary: "x" },
+    { cfg: {}, rememberImpl: async () => { called = true; return { ok: true }; } }
+  );
+  assert.equal(res.skipped, true, "skipped when disabled");
+  assert.equal(called, false, "remember() not called when disabled");
+});
+
+test("MEMORY: writeBackSession never throws even if remember() rejects", async () => {
+  const res = await daemon.writeBackSession(
+    { sender: "Alice Smith", subject: "s" },
+    { action: "respond", summary: "y" },
+    { cfg: ENABLED_ORG_CFG, rememberImpl: async () => { throw new Error("network down"); } }
+  );
+  assert.equal(res.ok, false, "fail-open result");
+  assert.equal(res.skipped, true, "reported skipped on throw");
+});
+
+// ---------------------------------------------------------------------------
+// Post-session OUTCOME DISCIPLINE — the daemon's parity with hq's meeting chair.
+// A turn that committed to next steps must not leave them in a session log; the
+// close path lands them through the org protocol. OFF unless the flag is set.
+// The parsing/landing itself is covered by session-outcomes.test.mjs — these
+// tests assert the DAEMON's wiring: identity + config injection, and fail-open.
+// ---------------------------------------------------------------------------
+
+test("OUTCOMES: the daemon hook lands a turn's commitments through the org protocol", async () => {
+  const created = [];
+  const remembered = [];
+  const res = await daemon.sweepOutcomesForSession({
+    sessionId: "s-daemon-1",
+    resultText: "Handled it.\n\nOUTCOMES:\n- Send the revised deck to Alice — due: Monday\n",
+    enabled: true,
+    cfg: ENABLED_ORG_CFG,
+    agent: { firstName: "Robin" },
+    item: {
+      service: "slack",
+      channel: "general",
+      channel_id: "C0GENERAL",
+      // The PUBLIC signal. A `C…` id alone proves nothing — Slack mints them
+      // for private channels too — so the gate needs the conversation type.
+      channel_type: "channel",
+      sender: "Alice Smith",
+      subject: "Deck review",
+    },
+    classResult: { action: "respond", summary: "deck review" },
+    createItemImpl: async (item) => { created.push(item); return { ok: true }; },
+    rememberImpl: async (text, opts) => { remembered.push({ text, opts }); return { ok: true }; },
+  });
+  assert.equal(res.created, 1, "the commitment became a board item");
+  assert.equal(created[0].title, "Send the revised deck to Alice");
+  assert.ok(created[0].detail.includes("Robin"), "the daemon supplied the agent identity");
+  assert.equal(remembered.length, 1, "and one knowledge episode records the set");
+});
+
+test("OUTCOMES: a private DM's commitments never leave the DM", async () => {
+  // CONFIDENTIALITY. A landed outcome is an ORG-VISIBLE artifact: board.create
+  // with no workstreamId is channel-less, and the episode's knowledge.append
+  // carries no group (so hq resolves it to the `org` group). Landing a DM's
+  // commitments would republish a one-to-one conversation — including its topic
+  // line — to every member of the org. The gate is fail-closed.
+  let touched = false;
+  const res = await daemon.sweepOutcomesForSession({
+    sessionId: "s-daemon-dm",
+    resultText: "OUTCOMES:\n- Send Alice the confidential term sheet — due: Monday\n",
+    enabled: true,
+    cfg: ENABLED_ORG_CFG,
+    agent: { firstName: "Robin" },
+    item: {
+      service: "slack",
+      channel: "dm/alice-smith",
+      channel_id: "D01ALICE",
+      is_dm: true,
+      sender: "Alice Smith",
+      subject: "DM from Alice Smith",
+    },
+    classResult: { action: "respond", summary: "confidential term sheet" },
+    createItemImpl: async () => { touched = true; return { ok: true }; },
+    rememberImpl: async () => { touched = true; return { ok: true }; },
+  });
+  assert.equal(res.created, 0);
+  assert.equal(res.reason, "source-dm");
+  assert.equal(touched, false, "no board row and no episode for a DM turn");
+});
+
+test("OUTCOMES: the daemon hook is OFF unless DAEMON_SESSION_OUTCOMES=1", async () => {
+  let touched = false;
+  const prior = process.env.DAEMON_SESSION_OUTCOMES;
+  try {
+    delete process.env.DAEMON_SESSION_OUTCOMES;
+    const res = await daemon.sweepOutcomesForSession({
+      sessionId: "s-daemon-2",
+      resultText: "OUTCOMES:\n- Do the thing",
+      cfg: ENABLED_ORG_CFG,
+      agent: { firstName: "Robin" },
+      createItemImpl: async () => { touched = true; return { ok: true }; },
+      rememberImpl: async () => { touched = true; return { ok: true }; },
+    });
+    assert.equal(res.skipped, true);
+    assert.equal(res.reason, "disabled");
+    assert.equal(touched, false, "nothing is written while the flag is off");
+  } finally {
+    if (prior === undefined) delete process.env.DAEMON_SESSION_OUTCOMES;
+    else process.env.DAEMON_SESSION_OUTCOMES = prior;
+  }
+});
+
+test("OUTCOMES: the daemon hook never throws into the dispatch path", async () => {
+  const res = await daemon.sweepOutcomesForSession({
+    sessionId: "s-daemon-3",
+    stdout: "{{{ not json",
+    enabled: true,
+    cfg: ENABLED_ORG_CFG,
+    agent: { firstName: "Robin" },
+    createItemImpl: async () => { throw new Error("network down"); },
+    rememberImpl: async () => { throw new Error("network down"); },
+  });
+  assert.ok(res && typeof res.created === "number", "benign result, no throw");
+  assert.equal(res.created, 0);
+});